tl;dr: zkAPI helps you to pay for a metered API with out being recognized. Deposit credit into an Ethereum vault as soon as, then authorize bounded utilization with zero-knowledge proofs as a substitute of an identification. The supplier sees the requests, and the fee layer sees the spend. Neither learns the hyperlink between them.
The Open Anonymity Project constructed it with the Ethereum Basis, and it runs on Ethereum Mainnet at present.
The issue
Each AI API name at present carries an identification. Your API key factors to an account, the account to a fee technique, and each immediate you ship joins the document connected to each. The supplier can join years of your utilization right into a single profile.
Prompts are private. Individuals ask AI fashions about their well being, their funds, their doubts. Underneath the present mannequin, utilizing AI means handing a working transcript of your pondering to whoever holds the billing relationship. The alternate options have been poor: pay per request onchain, which is sluggish, costly, and traceable by anybody, or belief a intermediary to not look.
The concept
zkAPI separates fee from identification. You deposit credit (ETH, USDC, and so on.) right into a vault contract on Ethereum, one peculiar transaction. From then on, your stability exists as a personal word: digital money that solely you’ll be able to spend and that no person can hint again to the deposit.
To authorize spending, software program in your machine produces a small zero-knowledge proof that claims, in impact, {that a} funded word covers this spend and no person has spent it earlier than. One proof can cowl a single request or a complete session. The server can examine that the assertion is true with out studying which word, which deposit, or which individual. On the fee layer, requests don’t hyperlink to you, and they don’t hyperlink to one another.
Two items of cryptography make this protected in addition to non-public. Deposits stay as commitments in a Merkle tree, so a proof can present “my word is without doubt one of the legitimate ones” with out pointing at any specific one. Each spend publishes a nullifier, a one-way serial quantity derived from the word’s secret. A person who stays inside their stability stays unlinkable. A person who tries to spend the identical stability twice produces a replica nullifier, which exposes the try and nothing else.
The way it works
The fee path (steps 1 to three) and the dialog path (step 4) share two objects: the short-lived key and its utilization receipt.
The server that handles cash by no means sees content material, and the supplier that sees content material by no means learns the billing identification behind a key.
- Your app talks to a small consumer working by yourself system. Nothing concerning the app modifications. It speaks the identical API it all the time did.
- The consumer sends the zkAPI server a proof of fee, with no immediate and no identification connected.
- The server checks the proof and mints a recent API key on the spot, short-lived and capped in {dollars}. The important thing exists solely in your system’s reminiscence.
- Your prompts go straight out of your system to the AI supplier with that key. When the important thing expires, the server prices your non-public stability for the metered utilization fairly than the reserved cap.
The spending cap works as a reservation. When the important thing expires, the supplier facet data the important thing’s whole utilization in a signed receipt, and the server deducts that quantity out of your word. Neither facet can rewrite the invoice afterward, and one authorization covers a complete session of requests fairly than one proof per name.
zkAPI additionally ships a less complicated proxy mode, the place the zkAPI server relays requests to the supplier itself. It’s simpler to function, however the relay sees site visitors. The runtime-key mode above exists in order that no fee middleman ever does.
zkAPI proves spends with Groth16 on the BN254 curve, hashes commitments and nullifiers with Poseidon, and retains notes in a Merkle tree 32 ranges deep. The server verifies spend proofs off-chain. The vault contract verifies the identical form of proof at deposit, shut, and escape, so your exit by no means relies on the server’s honesty.
In apply
| Celebration | Learns | By no means learns |
|---|---|---|
| zkAPI server | a sound fee exists, and whole {dollars} per session | who you might be, what you requested, which deposit paid |
| AI supplier | prompts and responses, because it runs the mannequin | who’s paying |
| Ethereum (public) | deposits, closes, withdrawals | what any stability paid for |
-
Your funds keep yours: The vault is a contract on Ethereum fairly than an organization account: you’ll be able to shut your stability and withdraw onchain, even when each zkAPI server disappears.
-
Your instruments keep the identical: The consumer exposes the usual OpenAI and Ollama APIs by yourself machine. Current apps, editors, and chat shoppers work by pointing them at localhost.
Use circumstances
AI inference comes first as a result of prompts are delicate and the billing path ties each to you. The identical consumer and contracts can entrance any service that prices per use:
| Use case | Metered unit | What the fee layer hides |
|---|---|---|
| AI chat and brokers | mannequin calls | which word paid, and any billing hyperlink between classes |
| Blockchain RPC | queries | which funding supply paid for the queries |
| Picture and video era | jobs | who paid for which jobs |
| VPNs and bandwidth | time and knowledge | who paid for the connection |
| Machine-to-machine companies | per-task spend | brokers pay with out an account |
zkAPI hides the fee hyperlink. A supplier nonetheless sees what a request accommodates and community metadata akin to your IP handle, and it might attempt to correlate classes by timing. Community anonymity and content material privateness are separate layers: a VPN or Tor handles the community facet, and confidential GPU computing is rising for content material.
For suppliers, integrating means accepting a proof as a substitute of an API key and settling signed utilization receipts as a substitute of sustaining accounts. Pricing, price limits, and infrastructure keep as they’re.
Limitations
zkAPI’s protections have two limitations: the shortage of community anonymity, and privateness leakage by way of immediate contents.
On the community facet, the principle problem is that the gateway can probably correlate request patterns from a person in the event that they ship requests to zkAPI below a secure person IP handle. Customers looking for stronger privateness might route requests by Tor and use a recent circuit for every session.
On the content material facet, particular person classes could also be re-linked by the inference supplier if the identical private particulars, writing fashion, reused dialog historical past, or challenge paperwork are offered. Shared immediate contents can act as fingerprints for anybody who can learn the prompts. It is a privacy-utility tradeoff: standalone queries are extra non-public however much less helpful since previous context is lacking. One mitigation is to leverage native or TEE fashions to generate requests on prime of shared reminiscence as a substitute of the person manually writing them. See additionally discussions within the Open Anonymity project post.
Background and hyperlinks
zkAPI is the working implementation of ZK API usage credits, a design revealed on Ethereum Analysis by Davide Crapis and Vitalik Buterin.
The Open Anonymity staff helped flip that design into the consumer, the server, and the contracts you’ll be able to run at present.
zkAPI is stay on Ethereum mainnet at present. Strive it:
Or build the local gateway and level any OpenAI-compatible app at it utilizing the docs.
